feat: Add new gcloud commands, API clients, and third-party libraries across various services.

gcloud auth application-default login/google-cloud-sdk/lib/surface/audit_manager/__init__.py

@@ -0,0 +1,41 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2024 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""The command group for Audit Manager CLI."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+class AuditManager(base.Group):
+  """Enroll resources, audit workloads and generate reports."""
+
+  category = base.SECURITY_CATEGORY
+
+  def Filter(self, context, args):
+    del context, args
+    # Don't ever take this off. Use gcloud quota for projects operations so
+    # you can create a project before you have a project.
+    base.DisableUserProjectQuota()
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class AuditManagerAlpha(AuditManager):
+  """Enroll resources, audit workloads and generate reports."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/audit_manager/audit_reports/__init__.py

@@ -0,0 +1,35 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2024 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for Audit Manager Audit Reports."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+class Reports(base.Group):
+  """Command group for Audit Manager Audit Reports."""
+
+  category = base.SECURITY_CATEGORY
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class ReportsAlpha(Reports):
+  """Command group for Audit Manager Audit Reports."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/audit_manager/audit_reports/generate.py

@@ -0,0 +1,115 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2024 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command to generate a new Audit Report."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from apitools.base.py import exceptions as apitools_exceptions
+from googlecloudsdk.api_lib.audit_manager import audit_reports
+from googlecloudsdk.api_lib.audit_manager import constants
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.audit_manager import exception_utils
+from googlecloudsdk.command_lib.audit_manager import flags
+from googlecloudsdk.core import exceptions as core_exceptions
+from googlecloudsdk.core import properties
+
+
+_DETAILED_HELP = {
+    'DESCRIPTION': 'Generate a new Audit Report.',
+    'EXAMPLES': """ \
+        To generate an Audit Report in the `us-central1` region,
+        for a project with ID `123` for compliance framework `fedramp_moderate` in `odf` format and store it in `gs://testbucketauditmanager` bucket, run:
+
+          $ {command} --project=123 --location=us-central1 --compliance-framework=fedramp_moderate --report-format=odf --gcs-uri=gs://testbucketauditmanager
+        """,
+}
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+class Generate(base.CreateCommand):
+  """Generate Audit Report."""
+
+  detailed_help = _DETAILED_HELP
+  api_version = constants.ApiVersion.V1
+
+  @staticmethod
+  def Args(parser):
+    flags.AddProjectOrFolderFlags(parser, 'for which to generate audit report')
+    flags.AddLocationFlag(parser, 'the report should be generated')
+    flags.AddComplianceFrameworkFlag(parser)
+    flags.AddReportFormatFlag(parser)
+    flags.AddDestinationFlags(parser)
+    parser.display_info.AddFormat(properties.VALUES.core.default_format.Get())
+
+  def Run(self, args):
+    """Run the generate command."""
+    is_parent_folder = args.folder is not None
+
+    scope = (
+        'folders/{folder}'.format(folder=args.folder)
+        if is_parent_folder
+        else 'projects/{project}'.format(project=args.project)
+    )
+
+    scope += '/locations/{location}'.format(location=args.location)
+
+    client = audit_reports.AuditReportsClient(api_version=self.api_version)
+
+    try:
+      return client.Generate(
+          scope,
+          args.compliance_framework,
+          report_format=args.report_format,
+          gcs_uri=args.gcs_uri,
+          is_parent_folder=is_parent_folder,
+      )
+
+    except apitools_exceptions.HttpError as error:
+      exc = exception_utils.AuditManagerError(error)
+
+      if exc.has_error_info(exception_utils.ERROR_REASON_NOT_ENROLLED):
+        exc.suggested_command_purpose = 'enroll the resource'
+        exc.suggested_command = (
+            f'{flags.GetCommandPrefix(args.command_path)} enrollments add'
+            f' {flags.GetProjectOrFolderParam(args)} {flags.GetLocationParam(args)}'
+            f' {flags.GetEligibleGcsBucketParam(args)}'
+        )
+      elif exc.has_error_info(exception_utils.ERROR_REASON_PERMISSION_DENIED):
+        role = 'roles/auditmanager.auditor'
+        user = properties.VALUES.core.account.Get()
+        exc.suggested_command_purpose = 'grant permission'
+        command_prefix = (
+            'gcloud resource-manager folders add-iam-policy-binding'
+            if is_parent_folder
+            else 'gcloud projects add-iam-policy-binding'
+        )
+        exc.suggested_command = (
+            f'{command_prefix}'
+            f' {args.folder if is_parent_folder else args.project}'
+            f' --member=user:{user} --role {role}'
+        )
+
+      core_exceptions.reraise(exc)
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class GenerateAlpha(Generate):
+  """Generate Audit Report."""
+
+  api_version = constants.ApiVersion.V1_ALPHA

gcloud auth application-default login/google-cloud-sdk/lib/surface/audit_manager/audit_scopes/__init__.py

@@ -0,0 +1,35 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2024 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for Audit Manager Audit Scopes."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+class AuditScopes(base.Group):
+  """Command group for Audit Manager Audit Scopes."""
+
+  category = base.SECURITY_CATEGORY
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class AuditScopesAlpha(AuditScopes):
+  """Command group for Audit Manager Audit Scopes."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/audit_manager/audit_scopes/generate.py

@@ -0,0 +1,124 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2024 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command to generate a new Audit Scope."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from apitools.base.py import exceptions as apitools_exceptions
+from googlecloudsdk.api_lib.audit_manager import audit_scopes
+from googlecloudsdk.api_lib.audit_manager import constants
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.audit_manager import exception_utils
+from googlecloudsdk.command_lib.audit_manager import flags
+from googlecloudsdk.core import exceptions as core_exceptions
+from googlecloudsdk.core import properties
+from googlecloudsdk.core.util import files
+
+
+_DETAILED_HELP = {
+    'DESCRIPTION': 'Generate a new Audit Scope.',
+    'EXAMPLES': """ \
+        To generate an Audit Scope in the `us-central1` region,
+        for a project with ID `123` for compliance framework `fedramp_moderate` in `odf` format, run:
+
+          $ {command} --project="123" --location="us-central1" --compliance-framework="fedramp_moderate" --report-format="odf" --output-directory="scopes/currentyear" --output-file-name="auditreport"
+        """,
+}
+
+_SCOPE_REPORT_CONTENTS = 'scopeReportContents'
+_FILE_EXTENSION = '.ods'
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+class Generate(base.CreateCommand):
+  """Generate Audit Scope."""
+
+  detailed_help = _DETAILED_HELP
+  api_version = constants.ApiVersion.V1
+
+  @staticmethod
+  def Args(parser):
+    flags.AddProjectOrFolderFlags(parser, 'for which to generate audit scope')
+    flags.AddLocationFlag(parser, 'the scope should be generated')
+    flags.AddComplianceFrameworkFlag(parser)
+    flags.AddScopeReportFormatFlag(parser)
+    flags.AddOutputDirectoryFormatFlag(parser)
+    flags.AddOutputFileNameFormatFlag(parser)
+
+  def Run(self, args):
+    """Run the generate command."""
+    is_parent_folder = args.folder is not None
+
+    scope = (
+        'folders/{folder}'.format(folder=args.folder)
+        if is_parent_folder
+        else 'projects/{project}'.format(project=args.project)
+    )
+    scope += '/locations/{location}'.format(location=args.location)
+
+    client = audit_scopes.AuditScopesClient(api_version=self.api_version)
+    try:
+      response = client.Generate(
+          scope,
+          args.compliance_framework,
+          report_format=args.report_format,
+          is_parent_folder=is_parent_folder,
+      )
+      self.SaveReport(
+          response,
+          args.output_directory,
+          args.output_file_name,
+      )
+      return response
+
+    except apitools_exceptions.HttpError as error:
+      exc = exception_utils.AuditManagerError(error)
+
+      if exc.has_error_info(exception_utils.ERROR_REASON_PERMISSION_DENIED):
+        role = 'roles/auditmanager.auditor'
+        user = properties.VALUES.core.account.Get()
+        exc.suggested_command_purpose = 'grant permission'
+        command_prefix = (
+            'gcloud resource-manager folders add-iam-policy-binding'
+            if is_parent_folder
+            else 'gcloud projects add-iam-policy-binding'
+        )
+        exc.suggested_command = (
+            f'{command_prefix}'
+            f' {args.folder if is_parent_folder else args.project}'
+            f' --member=user:{user} --role {role}'
+        )
+
+      core_exceptions.reraise(exc)
+
+  # TODO: b/324031367 - Add type annotations to all the methods.
+  def SaveReport(self, response, output_directory, output_file_name):
+    """Save the generated scope."""
+    is_empty_directory_path = output_directory == ''
+    directory_path = '' if is_empty_directory_path else output_directory + '/'
+    file_path = directory_path + output_file_name + _FILE_EXTENSION
+    content_bytes = response.scopeReportContents
+    files.WriteBinaryFileContents(file_path, content_bytes, overwrite=False)
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class GenerateAlpha(Generate):
+  """Generate Audit Scope."""
+
+  api_version = constants.ApiVersion.V1_ALPHA

gcloud auth application-default login/google-cloud-sdk/lib/surface/audit_manager/enrollments/__init__.py

@@ -0,0 +1,35 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2024 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for Audit Manager Enrollments."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+class Enrollments(base.Group):
+  """Command group for Audit Manager Enrollments."""
+
+  category = base.SECURITY_CATEGORY
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class EnrollmentsAlpha(Enrollments):
+  """Command group for Audit Manager Enrollments."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/audit_manager/enrollments/add.py

@@ -0,0 +1,111 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2024 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command to enroll a new scope."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from apitools.base.py import exceptions as apitools_exceptions
+from googlecloudsdk.api_lib.audit_manager import constants
+from googlecloudsdk.api_lib.audit_manager import enrollments
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.audit_manager import exception_utils
+from googlecloudsdk.command_lib.audit_manager import flags
+from googlecloudsdk.core import exceptions as core_exceptions
+from googlecloudsdk.core import properties
+
+
+_DETAILED_HELP = {
+    'DESCRIPTION': 'Enroll a new scope.',
+    'EXAMPLES': """ \
+        To enroll a project with ID `123` with `gs://test-bucket-1` and `gs://my-bucket-2` as eligible storage buckets, run:
+
+        $ {command} --project=123 --eligible-gcs-buckets="gs://test-bucket-1,gs://my-bucket-2"
+        """,
+}
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+class Add(base.CreateCommand):
+  """Enroll a new scope."""
+
+  detailed_help = _DETAILED_HELP
+  api_version = constants.ApiVersion.V1
+
+  @staticmethod
+  def Args(parser):
+    flags.AddProjectOrFolderOrOrganizationFlags(parser, 'to enroll')
+    flags.AddEligibleDestinationsFlags(parser)
+
+  def Run(self, args):
+    """Run the add command."""
+    is_parent_folder = args.folder is not None
+    is_parent_organization = args.organization is not None
+
+    if is_parent_folder:
+      scope = 'folders/{folder}'.format(folder=args.folder)
+    elif is_parent_organization:
+      scope = 'organizations/{organization}'.format(
+          organization=args.organization
+      )
+    else:
+      scope = 'projects/{project}'.format(project=args.project)
+
+    scope += '/locations/global'
+
+    client = enrollments.EnrollmentsClient(api_version=self.api_version)
+
+    try:
+      return client.Add(
+          scope,
+          eligible_gcs_buckets=args.eligible_gcs_buckets,
+          is_parent_folder=is_parent_folder,
+          is_parent_organization=is_parent_organization,
+      )
+
+    except apitools_exceptions.HttpError as error:
+      exc = exception_utils.AuditManagerError(error)
+
+      if exc.has_error_info(exception_utils.ERROR_REASON_PERMISSION_DENIED):
+        role = 'roles/auditmanager.admin'
+        user = properties.VALUES.core.account.Get()
+        exc.suggested_command_purpose = 'grant permission'
+        if is_parent_folder:
+          command_prefix = (
+              'gcloud resource-manager folders add-iam-policy-binding'
+          )
+        elif is_parent_organization:
+          command_prefix = (
+              'gcloud resource-manager organizations add-iam-policy-binding'
+          )
+        else:
+          command_prefix = 'gcloud projects add-iam-policy-binding'
+        exc.suggested_command = (
+            f'{command_prefix}'
+            f' {args.folder if is_parent_folder else args.organization if is_parent_organization else args.project}'
+            f' --member=user:{user} --role {role}'
+        )
+
+      core_exceptions.reraise(exc)
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class AddAlpha(Add):
+  """Enroll a new scope."""
+
+  api_version = constants.ApiVersion.V1_ALPHA

gcloud auth application-default login/google-cloud-sdk/lib/surface/audit_manager/operations/__init__.py

@@ -0,0 +1,35 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2024 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command group for Audit Manager operations."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from googlecloudsdk.calliope import base
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+class Operations(base.Group):
+  """Check audit operation status."""
+
+  category = base.SECURITY_CATEGORY
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class OperationsAlpha(Operations):
+  """Check audit operation status."""

gcloud auth application-default login/google-cloud-sdk/lib/surface/audit_manager/operations/describe.py

@@ -0,0 +1,76 @@
+# -*- coding: utf-8 -*- #
+# Copyright 2024 Google LLC. All Rights Reserved.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+"""Command to describe an existing Audit operation."""
+
+from __future__ import absolute_import
+from __future__ import division
+from __future__ import unicode_literals
+
+from apitools.base.py import exceptions as apitools_exceptions
+from googlecloudsdk.api_lib.audit_manager import constants
+from googlecloudsdk.api_lib.audit_manager import operations
+from googlecloudsdk.calliope import base
+from googlecloudsdk.command_lib.audit_manager import exception_utils
+from googlecloudsdk.command_lib.audit_manager import flags
+from googlecloudsdk.core import exceptions as core_exceptions
+
+
+_DETAILED_HELP = {
+    'DESCRIPTION': 'Obtain details about an audit operation.',
+    'EXAMPLES': """ \
+        To describe an Audit operation in the `us-central1` region,
+        belonging to a project with ID `123`, with operation ID `operation-456`, run:
+
+          $ {command} operation-456 --project=123 --location=us-central1
+        """,
+}
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.GA)
+class Describe(base.DescribeCommand):
+  """Describe Audit operation."""
+
+  detailed_help = _DETAILED_HELP
+  api_version = constants.ApiVersion.V1
+
+  @staticmethod
+  def Args(parser):
+    flags.AddDescribeOperationFlags(parser)
+
+  def Run(self, args):
+    """Run the describe command."""
+    result = args.CONCEPTS.operation.Parse()
+    resource = result.result
+    is_folder_parent = (
+        result.concept_type.name
+        == 'auditmanager.folders.locations.operationDetails'
+    )
+
+    client = operations.OperationsClient(api_version=self.api_version)
+
+    try:
+      return client.Get(resource.RelativeName(), is_folder_parent)
+    except apitools_exceptions.HttpError as error:
+      exc = exception_utils.AuditManagerError(error)
+      core_exceptions.reraise(exc)
+
+
+@base.DefaultUniverseOnly
+@base.ReleaseTracks(base.ReleaseTrack.ALPHA)
+class DescribeAlpha(Describe):
+  """Describe Audit operation."""
+
+  api_version = constants.ApiVersion.V1_ALPHA